Classified Cabinet Docs Leak Down Under Via An Actual Cabinet Sale... Just As Aussies Try To Outlaw Leaking

from the what-a-world dept

Back in December, we reported on an effort underway in Australia to criminalize both whistleblowers and journalists who publish classified documents with up to 20 years in prison. 20 years, by the way, is also the amount of time that Cabinet documents are supposed to be kept classified in Australia. But just recently Australia's ABC news suddenly started breaking a bunch of news that appeared to come from access to Cabinet documents that were still supposed to be classified. This included stories around ending welfare benefits for anyone under 30 years old as well as delaying background checks on refugees. Some explosive stuff.

On Wednsday, ABC finally revealed where all this stuff came from. It wasn't an Australian Ed Snowden. It was... government incompetence. Apparently, someone bought an old filing cabinet from a store that sells second-hand government office furniture. The cabinet had no key, so he drilled the lock and... found a ton of Cabinet documents in an actual cabinet.

So... if that law were to go through in Australia... would that mean the government employee who didn't check the filing cabinet would get 20 years in jail? Or the store that sold out? Or the guy that drilled it? Or do all of them get 20 years? Why don't we just support whistleblowers and the press for reporting on important news that the public should know about?

Filed Under: australia, cabinet, classified information, leaks, reporting, security, whistleblowing

Implementing Transparency About Content Moderation

from the not-as-easy-as-it-looks dept

On February 2nd, Santa Clara University is hosting a gathering of tech platform companies to discuss how they actually handle content moderation questions. Many of the participants have written short essays about the questions that will be discussed at this event -- and over the next few weeks we'll be publishing many of those essays, including this one.

When people express free speech-based concerns about content removal by platforms, one type of suggestion they generally offer is -- increase transparency. Tell us (on a website or in a report or with an informative "tombstone" left at the URL where the content used to be) details about what content was removed. This could happen lots of different ways, voluntarily or not, by law or industry standard or social norms. The content may come down, but at least we'll have a record and some insight into what happened, at whose request, and why.

In light of public discussions about platform transparency, especially in the past year, this post offers a few practical thoughts about transparency by online UGC platforms. First, some of the challenges platforms face in figuring out how to be transparent with users and the public about their content moderation processes. Second, the industry practice of transparency reports and what might be done to make them as useful as possible.

Content Moderation Processes & Decisions

So, why not be radically transparent and say everything? Especially if you're providing a service used by a substantial chunk of the public and have nothing to hide. Just post all takedown requests in their entirety and all correspondence with people seeking asking you to modify or remove content. The best place to start answering this is by mentioning some of the incentives a platform faces here and the reasonable reasons they might say less than everything (leaving aside self-interested reasons like avoiding outside scrutiny and saving embarrassment over shortcomings such as arguably inconsistent application of moderation rules or a deficient process for creating them).

First, transparency is sometimes in tension with the privacy of not just users of a service, but any person who winds up the subject of UGC. Just as the public, users, regulators, and academics are asking platforms to increase transparency, the same groups have made equally clear that platforms should take people's privacy rights seriously. The legal and public relations risks of sharing information in a way that abridges someone's privacy are often uncertain and potentially large. This does not mean they cannot be outweighed by transparency values, but I think in order to weight them properly, this tension has to be acknowledged and thought through. In particular, however anonymized a given data set is, the risks of de-anonymization increase with time as better technologies come to exist. Today's anonymous data set could easily be tomorrow's repository of personally identifiable information, and platforms are acting reasonably when choosing to safeguard these future and contingent rights for people by sometimes erring on the side of opacity around anything that touches user information.

Second, in some cases, publicizing detailed information about a particular moderation decision risks maintaining or intensifying the harm that moderation was intended to stop or lessen. If a piece of content is removed because it violates someone's privacy, then publicizing information about that takedown or redaction risks continuing the harm if the record is no carefully worded to exclude the private information. Or, in cases of harassment, it may provide information to the harasser or the public (or the harasser's followers, who might choose to join in) for that harassment to continue. In some cases, the information can be described at a sufficiently high level of generality to avoid harm (e.g., "a private person's home address was published and removed" or "pictures of a journalist's children were posted and removed). In other cases, it may be hard or impossible (e.g., "an executive at small company X was accused of embezzling by an anonymous user"). Of course, generalizing at too high a level may frustrate those seeking greater transparency as not much better than not releasing the information at all.

Finally, in some cases publicizing the details a moderation team's script or playbook can make the platform's rules easier to break or hack by bad faith actors. I don't think these are sufficient reason to perpetuate existing confidentiality norms. But, if platform companies are being asked or ordered to increase the amount of public information about content moderation and plan to do so, they may as well try to proceed in a way that will account for these issues.

Transparency Reports

Short of the granular information discussed above, many UGC platforms already issue regular transparency reports. Increasing expectations or commitments about what should be included in transparency reports could wind up an important way to move confidentiality norms while also ensuring that the information released is structured and meaningful.

With some variation, I've found that the majority of UGC platform transparency reports cover information across two axes. The two main types of requests are to remove/alter content and information requests. And then, within each of those categories, whether a given request comes from a private person or a government actor. A greater push for transparency might mean adding categories to these reports with more detail about the content of requests and the procedural steps taken along the way rather than just the usually binary output of "action taken" or "no action taken" that one finds in these reports, such as the law or platform rule that is the basis for removal, more detail about what relevant information was taken into account (such as, "this post was especially newsworthy because it said ..." or "this person has been connected with hate speech on [other platform]"). As pressure to filter or proactively filter platform content increases from legislators from places like Europe and Hollywood, we may want to add a category for removals that happened based on a content platform's own proactive efforts,, rather than a complaint.

Nevertheless, transparency reports as they are currently done raise questions about how to meaningfully interpret them and what can be done to improve their usefulness.

A key question I think we need to address moving forward: are the various platform companies' transparency reports apple-to-apples in their categories? Being able to someday answer yes would involve greater consistency in terms by industry (e.g, are they using similar terms to mean similar things, like "hate speech" or "doxxing," irrespective of their potentially differing policies about those types of content).

Relatedly, is there a consistent framework for classifying and coding requests received by each company. Doing more to articulate and standardize coding though maybe unexciting will be crucial infrastructure for providing meaningful classes and denominators for what types of actions people are asking platform companies to take and on what ground. Questions here include, is there relative consistency in how they each code a particular request or type of action taken in response? For example, a demand email with some elements of a DMCA notice, a threat of suit based on trademark infringement, an allegation of violation of rules/TOS based on harassment, and an allegation that the poster has action in breach of a private confidentiality agreement? What if a user makes a modification to their content of their own volition based on a DMCA or other request? What is a DMCA notice is received for one copy of a work posted by a user account, but in investigating, a content moderator finds 10 more works that they believe should be taken down based on their subjective judgment of the existence of possible red flag knowledge?

Another question is how to ensure the universe of reporting entities is complete. Are we missing some types of companies and as a result lacking information on what is out there? The first type that comes to mind is nominally traditional online publishers, like the New York Times or Buzzfeed, who also host substantial amounts of UGC, even if it is not their main line of business. Although these companies focus on their identity as publishers, they are also platforms for their own and others' content. (Section 3 of the Times' Terms of Service) spells out its UGC policy, and Buzzfeed's Community Brand Guidelines explain things such as the fact that a post with "an overt political or commercial agenda" will likely be deleted).

Should the Times publish a report on which comments they remove, how many, and why? Should they provide (voluntarily, by virtue of industry best practices, or by legal obligation) the same level of transparency major platforms already provide? If not, why not? (Another interesting question – based on what we've learned about the benefits of transparency into the processes by which online, content is published or removed, should publisher/platforms perhaps be encouraged to also provide greater transparency into non-UGC content that is removed, altered, or never published by virtue what has traditionally been considered editorial purview, such as a controversial story that is spiked at the last minute due to a legal threat or factual allegations removed from a story for the same reason? And over time, we can expect that more companies may exist that cannot be strictly classified as publisher or platform, but which should nevertheless be expected to be transparent about its content practices.) Without thinking through these question, we may lack a full data set of online expression and lose our ability to aggregate useful information about practices across types of content environments before we've started.

Alex Feerst is the Head of Legal at Medium

Filed Under: content moderation, free speech, hard choices, privacy, security, transparency

Senate IT Tells Staffers They're On Their Own When It Comes To Personal Devices And State-Sponsored Hackers

from the not-the-best-way-to-handle-an-impossible-situation dept

Notification of state-sponsored hacking attempts has revealed another weak spot in the US government's defenses. The security of the government's systems is an ongoing concern, but the Senate has revealed it's not doing much to ensure sensitive documents and communications don't end up in the hands of foreign hackers.

The news of the hacking attempt was greeted with assurances that nothing of value was taken.

That gap in security was brought front and center for Senate IT staffers on Jan. 12, when cybersecurity firm Trend Micro announced findings that seven months earlier, the same Russian government hacking group responsible for hacking Democratic Party targets in 2016 had created a phishing campaign that specifically targeted Senate staffers’ emails.

There’s no indication that the attempts were successful, and Trend Micro immediately alerted the FBI and the Office of the Sergeant at Arms, the agency responsible for Senate security, the firm said. Hours after Trend Micro’s report, multiple Senate staffers told BuzzFeed News, the sergeant-at-arms called a private meeting of Senate IT personnel to assure them that there was no real threat, as it had blocked the avenues the hackers would have tried to use.

It blocked those avenues, but Senate IT left a lot of avenues wide open. According to the Buzzfeed report, those in this meeting were told the protections offered would not include personal devices or email accounts. This makes some sense, as personnel have a responsibility to ensure their devices/accounts are as secure as possible if they're going to be using them for government work.

Laws and policies have been put in place to deter people from taking their sensitive work home with them. But they address a problem government agencies often exacerbate by treating employees as always on duty, even where they're off the clock. Multiple top government officials have been caught storing sensitive documents on private devices or in private accounts. Hillary Clinton underwent an FBI investigation because of this. Two years ago, a teenage hacker got a hold of documents detailing US military operations by gaining access to the CIA director's AOL account.

So, drawing a line at personal devices seems like the right thing to do, but only if you ignore the attack vectors left open by this policy. Even banning personal devices from government offices has its problems -- going far beyond the fact that this policy is pretty much unenforceable when there are thousands of staffers to keep an eye on.

Reached for comment, a sergeant-at-arms representative declined to give a formal statement, but told BuzzFeed News that its cybersecurity team’s specific directive is to protect Senate email accounts and Senate-issued devices.

But that could be a problem if a Senate staff member – there are thousands – uses a Senate device to also access personal email. If the staffer downloads a malicious program from personal email on a Senate-issued computer, that program could gain access to the device.

So… I don't know… throw the CFAA at them? [I'm joking, DOJ. Please don't do this.] There's no great solution to this problem. You can push the responsibility back on the person who became the attack vector but that just leaves sensitive government systems as weak as the weakest person with access. And employees should rightfully be wary of government attempts to "secure" devices and accounts, which could lead to lots of snooping into non-government communications.

It's impossible to secure everything but Senate IT shouldn't be so quick to wall off personal devices and accounts. Ignoring attack vectors doesn't solve the problem. Consistent enforcement of policies governing the handling of sensitive documents and communications might reduce the chances of a breach. But the problem remains the government's to deal with. As a former White House staffer notes in the article, the tools government employees need to do their jobs effectively aren't all supplied by the government. Many are supplied by third parties and may only run (or run well) on personal devices. The government can't be expected to be all things to all employees, but maybe it should consider extending its protective services to the devices and accounts it unofficially expects staffers to use.

Filed Under: encryption, hackers, it, privacy, security, senate, surveillance

Could It Be? Congress Actually Wants To Do The Right Thing On Electronic Voting!

from the please-make-it-happen dept

One of the topics we've talked about longer than any other topic on Techdirt is the problems with basically all electronic voting systems out there. Remember the good old days of Diebold, the well known voting machine maker? We wrote dozens of stories about its insecure machines starting back in 2003 and continued to write about the problems of electronic voting machines for years and years and years. We've gone through four Presidential elections since then and lots and lots of other elections -- and while the security on e-voting machines has improved, it hasn't improved that much and still is subject to all sorts of risks and questions. And those questions only serve to make people question the legitimacy of election results.

And, for all those years, it appeared that basically no one in Congress seemed to have any interest in actually doing anything. Until now. A new bipartisan bill has been introduced, called the Secure Elections Act, that would actually target insecure e-voting machines. The ideas in the bill are not revolutionary -- they're just what almost all computer security professionals have been calling for since we first started writing about e-voting machines all those many years ago, namely:

1. Strongly encourage states to get rid of paperless e-voting machines so that there is a verifiable paper trail that can be checked to make sure the electronic votes were counted accurately.
2. Do post-election audits of the machines to make sure that the machines accurately counted votes (i.e., not just in recount situations).

There's more in there as well, including a lot about information sharing on possible cybersecurity threats, which could be potentially quite useful, since elections are not run in any centralized way, but with locals (who often don't have much in the way of computer security knowledge) handling the details. This bill could help standardize some pretty key security practices that would make sure that the machines are safer and that the votes are more credible.

While some have raised concerns about the costs of getting rid of the older e-voting machines, the bill also allows for a grant-making process to help election agencies make this work -- and, really, the cost of botching elections seems like a bigger deal to me. The bill doesn't force states to get rid of the old machines (which Congress probably doesn't have the authority to do...), but does certainly give plenty of incentives (i.e. $$$$) for states to do the right thing.

The article (linked above) over at Ars Technica quotes a few e-voting system experts who are excited about the bill, but note that Congress should act fast if it wants states to actually follow through by the next election. And, of course, Congress is not exactly known for acting quickly. Still, this is a rare instance where it seems to have (finally) figured out how to take on an important issue and to do so intelligently.

Filed Under: congress, e-voting, electronic voting, paper trail, security

A Major Security Vulnerability Has Plagued 'Nearly All' Intel CPUs For Years

from the whoops-a-daisy dept

Intel is in for a very challenging few weeks. Reports began to bubble forth this week suggesting that "nearly all" intel chipsets (and some chipsets from other vendors) have been plagued by a security vulnerability over the last decade that could impact millions upon millions of users. While the full details of the vulnerability have been largely been kept under secret embargo by the security community, the scale of the flaw appears to be monumental. From what's currently known, the vulnerability currently allows programs to gain access to the layout or contents of what previously was believed to be protected kernel memory.

You know, the area where everything from passwords, login keys, and files cached from disk are presumably stored away from prying eyes. The problem appears to be unprecedented, and the entire security community is rushing to quickly push out updates for the problem:

"There is presently an embargoed security bug impacting apparently all contemporary CPU architectures that implement virtual memory, requiring hardware changes to fully resolve. Urgent development of a software mitigation is being done in the open and recently landed in the Linux kernel, and a similar mitigation began appearing in NT kernels in November. In the worst case the software fix causes huge slowdowns in typical workloads. There are hints the attack impacts common virtualization environments including Amazon EC2 and Google Compute Engine, and additional hints the exact attack may involve a new variant of Rowhammer.

So for one, this appears to have been in the wild for years, raising questions as to whether this has already been exploited by the intelligence community and others. And while the nature of the vulnerability isn't being fully disclosed, AMD hinted at the structure of a problem in an e-mail over the holiday to the Linux kernel mailing list stating that AMD products aren't affected:

"AMD processors are not subject to the types of attacks that the kernel page table isolation feature protects against. The AMD microarchitecture does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault."

At least one computer science PHD candidate at Vrije Universiteit Amsterdam claims to have already developed a proof of concept capable of exploiting the flaw to read kernel memory from user mode:

And while the vulnerability can be patched on the OS level (patches for the Linux kernel are already available even though the notes try to tap dance around the true nature of the issue), early reports indicate these updates could come with a much as a 30% performance penalty, something that will make gamers and other enthusiasts likely weep:

"Crucially, these updates to both Linux and Windows will incur a performance hit on Intel products. The effects are still being benchmarked, however we're looking at a ballpark figure of five to 30 per cent slow down, depending on the task and the processor model. More recent Intel chips have features – such as PCID – to reduce the performance hit. Your mileage may vary."

In other words, Intel's not only about to take a severe beating for a massive security vulnerability, but the performance of much of its product lineup is about to be dramatically impacted by the fix, which could flood the market with people looking for new, unimpacted CPUs. That's likely great news for AMD sales, but notably less so for Intel PR reps coming off of their holiday break, who'll be tasked with softening the perceived impact of the flaw ahead of more details in a week or two.

Filed Under: chipsets, intel, security
Companies: intel

Recent Intel Chipsets Have A Built-In Hidden Computer, Running Minix With A Networking Stack And A Web Server

from the what-could-possibly-go-wrong? dept

One way of looking at the history of computing is as the story of how the engineering focus rose gradually up the stack, from the creation of the first hardware, through operating systems, and then applications, and focusing now on platform-independent Net-based services. Underneath it all, there's still the processor, even if most people don't pay much attention to it these days. Unregarded it may be, but the world of the chip continues to move on. For example, for some years now, Intel has incorporated something called the Management Engine into its chipsets:

Built into many Intel Chipset–based platforms is a small, low-power computer subsystem called the Intel Management Engine (Intel ME). The Intel ME performs various tasks while the system is in sleep, during the boot process, and when your system is running. This subsystem must function correctly to get the most performance and capability from your PC.

That is, inside recent Intel-based systems, there is a separate computer within a computer -- one the end user never sees and has no control over. Although a feature for some time, it's been one of Intel's better-kept secrets, with details only emerging slowly. For example, a recent article on Network World pointed out that earlier this year, Dmitry Sklyarov (presumably, that Dmitry Sklyarov) worked out that Intel's ME is probably running a variant of the Minix operating system (yes, that Minix.) The Network World article notes that a Google project has found out more about the ME system:

According to Google, which is actively working to remove Intel's Management Engine (MINIX) from their internal servers (for obvious security reasons), the following features exist within Ring -3:

Full networking stack
File systems
Many drivers (including USB, networking, etc.)
A web server

That’s right. A web server. Your CPU has a secret web server that you are not allowed to access, and, apparently, Intel does not want you to know about.

Why on this green Earth is there a web server in a hidden part of my CPU? WHY?

The "Ring-3" mentioned there refers to the level of privileges granted to the ME system. As a Google presentation about ME (pdf) explains, operating systems like GNU/Linux run on Intel chips at Ring 0 level; Ring-3 ("minus 3") trumps everything above -- include the operating system -- and has total control over the hardware. Throwing a Web server and a networking stack in there too seems like a really bad idea. Suppose there was some bug in the ME system that allowed an attacker to take control? Funny you should ask; here's what we learned earlier this year:

Intel says that three of its ME services -- Active Management Technology, Small Business Technology, and Intel Standard Manageability -- were all affected [by a critical bug]. These features are meant to let network administrators remotely manage a large number of devices, like servers and PCs. If attackers can access them improperly they potentially can manipulate the vulnerable computer as well as others on the network. And since the Management Engine is a standalone microprocessor, an attacker could exploit it without the operating system detecting anything.

As the Wired story points out, that critical bug went unnoticed for seven years. Because of the risks a non-controllable computer within a computer brings with it, Google is looking to remove ME from all its servers, and there's also an open source project doing something similar. But that's difficult: without ME, the modern systems based on Intel chipsets may not boot. The problems of ME have led the EFF to call on Intel to make a number of changes to the technology, including:

Provide a way for their customers to audit ME code for vulnerabilities. That is presently impossible because the code is kept secret.

Offer a supported way to disable the ME. If that's literally impossible, users should be able to flash an absolutely minimal, community-auditable ME firmware image.

Those don't seem unreasonable requests given how serious the flaws in the ME system have been, and probably will be again in the future. It also seems only fair that people should be able to control fully a computer that they own -- and that ought to include the Minix-based computer hidden within.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cpus, hidden computer, minix, privacy, security, web servers
Companies: intel

Report Finds DHS Terrible At Keeping Track Of Agents' Badges And Guns

from the shrugs-of-official-indifference dept

Not really sure why we're putting the Department of Homeland Security in charge of securing anything.

Between fiscal years 2014 and 2016, the Department of Homeland Security personnel lost a total of 2,142 highly sensitive assets — 228 firearms; 1,889 badges; and 25 secure immigration stamps.

That's from the latest Inspector General's report [PDF] on DHS components' ability to secure items that might wreak havoc -- ranging from inappropriate access to multiple deaths -- if left improperly secured. This includes current presidential faves CBP and ICE -- both DHS components.

The bad news is it's good news:

Although this represents a slight improvement from our last audit, more than half of the lost items we reviewed (65 of 115) revealed that component personnel did not follow policy or used poor judgment when safeguarding these assets.

The IG should probably not expect more year-to-year improvements, no matter how slight.

In these cases, components did not always hold personnel accountable nor did they receive remedial training for failing to safeguard these sensitive assets.

And I'm not kidding about loose components causing death. The report points to a 2015 robbery where something ICE didn't secure led to exactly this.

Even with new controls designed to strengthen the security of sensitive assets, lost or stolen Federal firearms continue to be used to commit serious crimes. For instance, a media article reported a September 2015 robbery in which an attacker killed a man with an Immigration and Customs Enforcement (ICE) firearm that was stolen from an unattended vehicle. The ICE agent failed to properly secure the weapon inside the vehicle in a high crime area.

ICE in particular seems particularly careless with firearms.

Two off duty ICE officers left their firearms unsecured and unattended in backpacks while on a beach in Puerto Rico. When the officers returned the bags were gone.

An ICE officer left his firearm, badge, and credential unsecured in his hotel room while on vacation. As he slept, his overnight guest stole his belongings.

But take heart, those of you concerned about the border being overrun by non-US citizens. The CBP is just as terrible.

A Customs and Border Protection (CBP) officer left his backpack containing his wallet and government badge in an unlocked public gym locker. When he returned, his belongings were gone.

A CBP officer left his firearm in a bag at a friend’s house. When he returned 2 days later, the gun could not be located.

A CBP officer left his firearm and other law enforcement equipment in an unlocked vehicle overnight. The following day he realized his firearm and two magazines were no longer in the vehicle.

Actually, it appears CBP has been asking ICE to hold its beer, in terms of responsible weapons handling.

At a CBP regional armory, 208 firearms could not be physically located. The property custodian researched the situation, and approximately 2 weeks later provided documentation of the actual physical locations for each firearm, which included various lockers and storage vaults across CBP’s field offices.

[...]

At a CBP office, the property custodian was unable to immediately locate firearms from the inventory. After searching the facility, the property custodian discovered the firearms in a random file cabinet, stored haphazardly in boxes.

Yes, one CBP office was utilizing a gun filing system (using an actual file cabinet) that resembled just one of several horrifying finds in an episode of Hoarders.

Worse than the DHS's gun handling was its badge handling. Nearly 2,000 badges were unaccounted for, which means any number of people could be roaming around impersonating government agents. A couple of badge flashes from a 100% legitimate badge (in terms of origin, not current carrier) can help the holder obtain access to off-limits areas and/or personal identifying information on citizens/non-citizens, and otherwise abuse a borrowed position of power. On top of the incalculable costs, there's the tax dollars involved in replacing them at $40-75 a pop.

Things won't improve if the DHS doesn't start taking this more seriously. More than half of the cases reviewed by the IG ended with nothing more than a letter of reprimand… at the most. In 22 of the 65 cases reviewed, no disciplinary action at all was taken.

And these disciplinary actions will need to be preceded by rigid, standardized policies on handling of sensitive items. In addition, the DHS will actually need to establish a credible tracking system. The items tallied by the IG may only be the tip of the iceberg. As it notes in its report, it was unable to obtain enough documentation on nearly one-quarter of the items reviewed to determine whether the losses were due to careless handling.

These are the people securing our borders and playing an integral part in our national security directives. And yet they're leaving guns in unattended backpacks and leaving badges behind in restaurants and amusement parks. And the DHS doesn't consider this to be enough of a problem to handle with meaningful punishments or consistent policies and reporting.

Filed Under: badges, dhs, guns, homeland security, security

The Cyber World Is Falling Apart And The DOJ Is Calling For Weakened Encryption

from the better-for-cops,-worse-for-everyone-else dept

It seemed like the (mostly) one-man War on Encryption had reached a ceasefire agreement when "Going Dark" theorist James Comey was unceremoniously ejected from office for failing to pledge allegiance to the new king president. But it had barely had time to be relegated to the "Tired" heap before Deputy Attorney General Rod Rosenstein resurrected it.

Rosenstein has been going from cybersecurity conference to cybersecurity conference raising arguments for encryption before dismissing them entirely. His remarks have opened with the generally awful state of cybersecurity at both the public and private levels. He says encryption is important, especially when there are so many active security threats. Then he undermines his own arguments by calling for "responsible encryption" -- a euphemism for weakened encryption that provides law enforcement access to locked devices and communications on secured platforms.

Considering recent events, this isn't the direction the DOJ should be pushing. Russian hackers used a popular antivirus software to liberate NSA exploits from a contractor's computer. Equifax exposed the data of millions of US citizens who never asked to be tracked by the service in the first place. Yahoo just admitted everyone who ever signed up for its email service was affected by a years-old security breach. Ransomware based on NSA malware wreaked havoc all over the world. These are all issues Rosenstein has touched on during his remarks. But they're swiftly forgotten by the Deputy Attorney General when his focus shifts to what he personally -- representing US law enforcement -- can't access because of encryption.

DAG Rosenstein needs to pay more attention to the first half of his anti-encryption stump speeches, as Matthew Green points out at Slate:

[A]ny technology that allows U.S. agencies to lawfully access data will present an irresistible target for hackers and foreign intelligence services. The idea that such data will remain safe is laughable in a world where foreign intelligence services have openly leveraged cyberweapons against corporate and political targets. In his speech, Rosenstein claims that the “master keys” needed to enable his proposal can be kept safe, but his arguments are contradicted by recent history. For example, in 2011 hackers managed to steal the master keys for RSA’s SecurID authentication product—and then used those keys to break into a slew of defense contractors. If we can’t secure the keys that protect top-secret documents, it’s hard to believe we’ll do better for your text messages.

Rosenstein is steering everyone towards his new term "responsible encryption" but there's nothing responsible about creating a set of encryption keys for lawful access. It may not necessarily be a backdoor -- a term Rosenstein is trying hard to distance himself from -- but it is a hole that wouldn't otherwise exist. And if keys are created and stored by manufacturers and platform providers, the chance malicious hackers can find them will always remain above 0%.

Filed Under: cybersecurity, encryption, going dark, hacks, matthew green, rod rosenstein, security